From 04e18dd9029ad602419eccbe4ad7e903aada3b2e Mon Sep 17 00:00:00 2001 From: tomcruiseqi <10762123+tomcruiseqi@user.noreply.gitee.com> Date: Fri, 4 Sep 2026 16:09:52 +0800 Subject: [PATCH] [CVE][Upstream] Add patch to fix CVE-2026-16118 To #bug45174 commit 1debecbfe5a643dd7bd1a70f40cf86b007edbd43 upstream Project: TC2024080204 Signed-off-by: tomcruiseqi --- 001016-bugfix-for-CVE-2026-16118.patch | 47 ++++++++++++++++++++++++++ glib2.spec | 8 ++++- 2 files changed, 54 insertions(+), 1 deletion(-) create mode 100644 001016-bugfix-for-CVE-2026-16118.patch diff --git a/001016-bugfix-for-CVE-2026-16118.patch b/001016-bugfix-for-CVE-2026-16118.patch new file mode 100644 index 0000000..d59e0d8 --- /dev/null +++ b/001016-bugfix-for-CVE-2026-16118.patch @@ -0,0 +1,47 @@ +From ca75aff83af9875ea2ad2bfbe48a85dfd99c2ce5 Mon Sep 17 00:00:00 2001 +From: Kashyap Ekbote +Date: Wed, 5 Aug 2026 20:50:10 +0530 +Subject: [PATCH] Fix CVE-2026-16118: heap-buffer-overflow in xdgmimemagic.c + +Fix out-of-bounds write in the byte-swap routine of +_xdg_mime_magic_parse_magic_line(). On little-endian systems, the +write side of the swap casts the base pointer to a wider type before +adding the byte offset, causing pointer arithmetic to scale by +sizeof(type) instead of 1. With value_length=4 and word_size=2, the +loop writes 2 bytes past the allocated matchlet->value buffer at i=2. + +Parenthesize (ptr + i) before the cast so both the read and write +sides use byte offsets. + +Upstream: https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41 +--- + gio/xdgmime/xdgmimemagic.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/gio/xdgmime/xdgmimemagic.c b/gio/xdgmime/xdgmimemagic.c +index 98a1274c8..fe374eb4e 100644 +--- a/gio/xdgmime/xdgmimemagic.c ++++ b/gio/xdgmime/xdgmimemagic.c +@@ -483,15 +483,15 @@ _xdg_mime_magic_parse_magic_line (FILE *magic_file, + for (i = 0; i < matchlet->value_length; i = i + matchlet->word_size) + { + if (matchlet->word_size == 2) +- *((xdg_uint16_t *) matchlet->value + i) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->value + i))); ++ *((xdg_uint16_t *) (matchlet->value + i)) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->value + i))); + else if (matchlet->word_size == 4) +- *((xdg_uint32_t *) matchlet->value + i) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->value + i))); ++ *((xdg_uint32_t *) (matchlet->value + i)) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->value + i))); + if (matchlet->mask) + { + if (matchlet->word_size == 2) +- *((xdg_uint16_t *) matchlet->mask + i) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->mask + i))); ++ *((xdg_uint16_t *) (matchlet->mask + i)) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->mask + i))); + else if (matchlet->word_size == 4) +- *((xdg_uint32_t *) matchlet->mask + i) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->mask + i))); ++ *((xdg_uint32_t *) (matchlet->mask + i)) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->mask + i))); + + } + } +-- +2.43.0 + diff --git a/glib2.spec b/glib2.spec index 83b1c65..ad71d3c 100644 --- a/glib2.spec +++ b/glib2.spec @@ -1,4 +1,4 @@ -%define anolis_release 14 +%define anolis_release 15 Name: glib2 Version: 2.78.3 Release: %{anolis_release}%{?dist} @@ -59,6 +59,9 @@ Patch001013: 001013-bugfix-for-CVE-2026-58011.patch Patch001014: 001014-bugfix-for-CVE-2026-58016.patch Patch001015: 001015-bugfix-for-CVE-2026-15588.patch +# https://gitlab.freedesktop.org/xdg/xdgmime/-/commit/1debecbfe5a643dd7bd1a70f40cf86b007edbd43 +Patch001016: 001016-bugfix-for-CVE-2026-16118.patch + BuildRequires: gcc meson >= 0.60.0 gettext gtk-doc perl-interpreter glibc-devel BuildRequires: systemtap-sdt-devel zlib-devel python3-devel BuildRequires: bash-completion >= 2.0 elfutils-libelf-devel libffi-devel >= 3.0.0 @@ -202,6 +205,9 @@ touch %{buildroot}%{_libdir}/gio/modules/giomodule.cache %doc NEWS README.md %changelog +* Fri Sep 04 2026 tomcruiseqi - 2.78.3-15 +- Fix CVE-2026-16118 + * Sun Aug 23 2026 tomcruiseqi - 2.78.3-14 - Fix CVE-2026-58016,CVE-2026-15588 -- Gitee